QR Codes Kill Kittens, a book by marketing guru Scott Stratten, was released a few years ago to teach marketers how NOT to use QR codes. As an example, if you receive a QR code on your phone without a corresponding normal link, how are you supposed to scan it? He jokes that every time a marketer does something dumb like that, somewhere, a kitten is harmed.
Information security uses this phrase for QR codes seen “in the wild”. Because, while they’re not inherently bad, QR codes can be hijacked without you realizing it.
How does a QR code work? As defined in Forbes, a QR code (Quick Response code) is a two-dimensional barcode that is readable by a smartphone with a camera. It allows the encoded image to contain over 4,000 characters in a condensed, machine-readable format and was designed as a rapid method to share content or do a specific task.
QR codes have been able to help different businesses and organizations accomplish different ways to share promotions, information, surveys, forms etc. Unfortunately, it is easy enough for scammers to take advantage and hijack the good intention of a QR code.
For example, if you scan a QR code to complete an email message with a subject line and recipient, the scammer could then collect your email address in the process once you hit send. Which could lead to future phishing or spear-phishing attacks.
Another basic concern is scanning a QR code could automatically launch or redirect you to a website (even if you believe the code will bring you elsewhere). This is risky because if the code has indeed been hijacked, the website that opens could contain malware, an exploit or other undesirable content. Therefore, there’s unfortunately no way for someone to know if a QR code is safe by just looking at it. So before implementing in your marketing, the first considerations you should make are:
- The environment: If you place a QR code in random spots out in public, especially relating to promotions or events, it is likely to be hijacked (or even seen as unsafe). Place them in areas where proximity and the environment make sense.
- Where it’s placed: If a QR code has been stuck somewhere seemingly random, ie. sidewalk bench, public tables, telephone poles, etc., viewers will be very cautious of how “official” that code is.
Remember, viewers should be treating public QR code like a wild animal they want to photograph: do not approach – and certainly don’t scan it. So, when you use QR codes, think of the kittens.
Birmingham Consulting. For when the storm comes℠
